What’s Vulnerable › Vulnerabilities

CVE-2025-42928: Deserialization Vulnerability in SAP jConnect - SDK for ASE

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-09 · updated 2026-10-07
• Weakness: CWE-502

Description

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

Affected products

• SAP_SE SAP jConnect - SDK for ASE: SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4, 16.1

References

• https://me.sap.com/notes/3685286
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42928 or the next vulnerability affects your stack